SQL String Quotes

[Scott]

I've got a db that has a table called USERS that contains ip addresses for
each record. Below, I'm trying to select any user with an ip address equal
to the variable "usserIP". What are the proper quotes to use when using SQL
to compare a string variable to a text column?

The database is an Access 2000 database and I'm using ASP Classic.

CODE: *************** ********

sSQL = "SELECT * FROM Users WHERE IP= " & "'" & userIP & "'"

[Bob Barrows]

Re: SQL String Quotes

Scott wrote:

I've got a db that has a table called USERS that contains ip
addresses for each record. Below, I'm trying to select any user with
an ip address equal to the variable "usserIP". What are the proper
quotes to use when using SQL to compare a string variable to a text
column?
The database is an Access 2000 database and I'm using ASP Classic.
>
CODE: *************** ********
>
sSQL = "SELECT * FROM Users WHERE IP= " & "'" & userIP & "'"

With Jet, either full quotes or single quotes (apostrophes) may be used. Of
course, you could use parameters and never have to worry about delimiters
again, as well as eliminating the possibility that a hacker could compromise
your site using sql injection. See:

http://groups-beta.google.com/group/microsoft.public.inetserver.asp.db/msg/72e36562fee7804e

--
Microsoft MVP - ASP/ASP.NET - 2004-2007
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

[Anthony Jones]

Re: SQL String Quotes


"Bob Barrows" <reb01501@NOyah oo.SPAMcomwrote in message
news:uubaMv1RJH A.588@TK2MSFTNG P06.phx.gbl...

Scott wrote:

>I've got a db that has a table called USERS that contains ip
>addresses for each record. Below, I'm trying to select any user with
>an ip address equal to the variable "usserIP". What are the proper
>quotes to use when using SQL to compare a string variable to a text
>column?
>The database is an Access 2000 database and I'm using ASP Classic.
>>
>CODE: *************** ********
>>
> sSQL = "SELECT * FROM Users WHERE IP= " & "'" & userIP & "'"

>
With Jet, either full quotes or single quotes (apostrophes) may be used.
Of course, you could use parameters and never have to worry about
delimiters again, as well as eliminating the possibility that a hacker
could compromise your site using sql injection. See:

http://groups-beta.google.com/group/microsoft.public.inetserver.asp.db/msg/72e36562fee7804e

>
>
>

Whilst I agree completely that a command would be much better that
concatentation in this case if the REMOTE_ADDR from which the OP will be
drawing the IP address from has been hacked to contain something malicious
then the site is already in big trouble. ;)

--
Anthony Jones - MVP ASP/ASP.NET